macrozheng/mall-learning · error · UsernameNotFoundException
用户名或密码错误
Error message
用户名或密码错误
What it means
This is a Spring Security UsernameNotFoundException thrown by the UserDetailsService lambda in MallSecurityConfig when getAdminByUsername returns no admin for the submitted username. The message deliberately says '用户名或密码错误' (username or password wrong) instead of 'user not found' to avoid leaking which accounts exist. It is part of the login authentication flow: Spring DaoAuthenticationProvider calls this UserDetailsService before password matching.
Solutions
- Verify the ums_admin table contains a row with that exact username (SELECT * FROM ums_admin WHERE username = '...')
- Check spring.datasource settings point at the database the seed data (mall_tiny.sql) was loaded into
- Register the admin first via the register endpoint or insert the default admin row
- Trim/normalize the username in the client before submitting
Example fix
// before
AdminUserDetails admin = adminService.getAdminByUsername(username);
if (admin != null) { return admin; }
throw new UsernameNotFoundException("用户名或密码错误");
// after
AdminUserDetails admin = adminService.getAdminByUsername(username);
if (admin != null) { return admin; }
// ensure the seed user exists; log for diagnosis without leaking detail
log.warn("Login attempt for unknown user: {}", username);
throw new UsernameNotFoundException("用户名或密码错误"); Defensive patterns
Strategy: try-catch
Validate before calling
// before calling the API
const username = form.username.trim();
if (!username) { alert('请输入用户名'); }
// optional server-side existence check (admin-only):
// SELECT COUNT(*) FROM ums_admin WHERE username = ? Try / catch
try {
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
} catch (BadCredentialsException | UsernameNotFoundException e) {
// single generic message: '用户名或密码错误'
throw new ApiException("用户名或密码错误");
} Prevention
- Always import the project's seed SQL before first login
- Verify datasource URL/profile per environment
- Trim and normalize username input client-side
- Use the register endpoint to create accounts before logging in
- Don't reveal whether username or password was wrong
When it happens
Trigger: POST /admin/login (or any authenticate call) with a username that does not exist in the ums_admin table; adminService.getAdminByUsername returns null so the lambda throws.
Common situations: Typos in username during login, testing against a database where the seed admin user was never inserted, pointing the app at the wrong database/schema so the admin row is missing, case-sensitivity mismatch in stored usernames, or frontend sending an empty/untrimmed username.
Understand the failure class
Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.
Related errors
AI-assisted analysis of macrozheng/mall-learning@cd02c000e5 (2026-09-07).
Data as JSON: /api/errors/2ecbb839ce086f50.
Report an issue: GitHub.
Appendix: source
Thrown at mall-tiny-04/src/main/java/com/macro/mall/tiny/config/MallSecurityConfig.java:31
* @description 自定义配置，用于配置如何获取用户信息
* @date 2022/5/20
* @github https://github.com/macrozheng
*/
@Configuration
public class MallSecurityConfig {
@Autowired
private UmsAdminService adminService;
@Bean
public UserDetailsService userDetailsService() {
//获取登录用户信息
return username -> {
AdminUserDetails admin = adminService.getAdminByUsername(username);
if (admin != null) {
return admin;
}
throw new UsernameNotFoundException("用户名或密码错误");
};
}
}
View on GitHub (pinned to cd02c000e5)